Reverse engineering the die of a ULN2003 transistor array

uln2003-die-reverse-engineering

We’re no strangers to looking at uncapped silicon. This time around it’s not just a show and tell, as one transistor form a ULN2003 chip is reverse engineered.

The photo above is just one slice from a picture of the chip after having its plastic housing remove (decapped). It might be a stretch to call this reverse engineering. It’s more of a tutorial on how to take a functional schematic and figure out how each component is placed on a photograph of a chip die. Datasheets usually include these schematics so that engineers know what to expect from the hardware. But knowing what a resistor or transistor looks like on the die is another story altogether.

The problem is that you can’t just look at a two dimensional image like the one above. These semiconducting elements are manufactured in three dimensions. The article illustrates where the N and P type materials are located on the transistor using a high-res photo and a reference diagram.

If you want to photograph your own chip dies there are a few ways to decap them at home.

Boiling acid used to see chip die

When a project starts off by heating acid to its boiling point we say no thanks. But then again we’re more for the projects that use ones and zeros or a hot soldering iron. If you’re comfortable with the chemistry like [Michail] this might be right up your alley. He used boiling acid to expose and photograph the die from several integrated circuits.

The title of our feature is a play on words. In this case, die refers to the silicone on which the IC has been etched. To protect it the hardware manufacturer first attaches the metal pins to the die, then encapsulates it in plastic. [Michail] removes that plastic case by heating sulfuric acid to about 300 degrees Celsius (that’s 572 Fahrenheit) then submerges the chips in the acid inside of a sealed container for about forty minutes. Some of the larger packages require multiple trips through the acid bath. After this he takes detailed pictures of the die and uses post processing to color enhance them.

This isn’t the only way to get to the guts of a chip. We’ve seen nitric acid and even tree sap (in the form of bow rosin) do the trick.

Taking a look at decapped ICs

Aside from wanting to play around with nitric acid, [Ben] really didn’t have a reason to decap a few 74xx and 4000-series logic chips. Not that we mind, as he provides a great tutorial at looking at a bare IC that isn’t covered in epoxy and resin.

Most ICs are encased in a hard epoxy shell making it very difficult to look at the circuits within. [Ben] tried to grind this epoxy off with a Dremel tool, but didn’t have much luck until he moved over to a CNC mill to remove 0.040 – 0.050″ of epoxy without breaking the bond wires.

After carving out a nice pocket above the die, [Ben] put a few drops of nitric acid on the chip to dissolve the epoxy coating.  This worked very slowly at room temperature, but after putting the chips on a hot plate the acid was able to reveal the die underneath.

After successfully removing all the epoxy and giving them an acetone bath, [Ben] took his chips over to the microscope and was able to check out the underlying circuit. He doesn’t have any idea what he could do with these decapped logic chips, but the bond wires are still intact so he could still use these chips in a build.

We’d like to see a few decapped MEMS devices, but if you have a suggestion on what [Ben] can do with his decapped chips, drop a note in the comments.

[Read more...]

Follow

Get every new post delivered to your Inbox.

Join 97,581 other followers